Public Team State Overrides

Public endpoint: sparse list of team visibility overrides keyed by slug.

Same pattern as /public/task-type-overrides. The frontend ships the full team catalog statically (frontend/src/lib/team-catalog.ts), so this endpoint only needs to return the exceptions from the default live state. No auth.

We also honor the teams_enabled env kill-switch — if teams are disabled platform-wide, every team effectively becomes hidden, regardless of its DB state. This keeps the env-flag-wins-on-conflict semantics from app.services.visibility.effective_state consistent across every public surface that reads team state.

Frontend treats missing slugs as live.